Major medical device manufacturer notifies nearly 4 million of breach

The world’s largest medical device company is notifying more than 3.8 million people that their data may have been exposed in an attack reportedly linked to the ShinyHunters cybercrime group.

On April 24, Medtronic confirmed an unauthorized party had accessed data in certain corporate IT systems, but said it had not identified any “connections to our customers.” But on June 29, the California Attorney General released a copy of Medtronic’s notification letter, which warned that “as a patient with a Medtronic medical device, our company collects data related to you in order to provide important product-related updates and to meet our legal obligations.”

Social security numbers, health-related data, names, contact information and dates of birth were accessed by the hackers, according to the letter. The company said it has “no evidence that impacted information has been publicly posted or exposed on the internet.” 

The med tech giant said it is providing affected individuals with 24 months of free credit monitoring, dark web monitoring and “identity theft restoration services.”

The Medtronic breach is just the latest example of a hacking gang targeting a company in the med tech sector.

In March, the medical device firm Stryker disclosed that its systems had been wiped in a cyberattack that federal prosecutors said was carried out by Iran-backed hackers.

That attack "had a direct impact on emergency medical services and hospitals within Maryland” and “prompted some hospitals to temporarily suspend connections” to Stryker because they were worried they could be impacted by the wiper incident.